fix(install): unbreak curl|bash one-liner (regression in v1.8.0)

Two bugs at the curl|bash entry point made the headline install command
fail immediately:

1. install.sh used `${BASH_SOURCE[0]}` under `set -u`. That variable is
   unset when bash is invoked from stdin (curl | bash), tripping the
   nounset trap before we ever reached the npx fallback.
2. install.sh + install.ps1 passed `--` between npx and the package args.
   On modern npm, npx forwards the literal `--` to bin/install.js, which
   parseArgs rejected as an unknown flag.

Fix:
- install.sh: default BASH_SOURCE[0] to empty so the curl-pipe path falls
  through cleanly under set -u.
- install.sh + install.ps1: drop the `--` separator. npm 7+ npx already
  forwards trailing args correctly.
- bin/install.js parseArgs: accept a bare `--` as a no-op (POSIX
  end-of-options marker) so future shim drift can't re-break this.
- New regression test asserts `--` is accepted.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

bin/install.js

@@ -69,6 +69,10 @@ function parseArgs(argv) {
       case '--uninstall': case '-u': opts.uninstall = true; break;
       case '--non-interactive': opts.nonInteractive = true; break;
       case '-h': case '--help': opts.help = true; break;
+      // POSIX end-of-options marker. Older curl|bash flows pipe `-- --only foo`
+      // through npx; some npx versions forward the literal `--`. Accept and
+      // ignore so we never regress on the headline install command.
+      case '--': break;
       case '--only': {
         const v = argv[++i];
         if (!v) die('error: --only requires an argument');

install.ps1

@@ -55,5 +55,8 @@ if (-not $npx) {
   exit 1
 }
 
-& npx -y "github:$Repo" -- @Args
+# Do NOT pass `--` here — npm 7+ npx already forwards trailing args to the
+# package, and a literal `--` was tripping bin/install.js's parseArgs as an
+# unknown flag.
+& npx -y "github:$Repo" @Args
 exit $LASTEXITCODE

install.sh

@@ -35,16 +35,20 @@ if [ "$NODE_MAJOR" -lt 18 ]; then
 fi
 
 # If we're inside the repo clone, run the local installer directly — saves
-# the npx round-trip and keeps offline installs working.
-here="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)" || here=""
+# the npx round-trip and keeps offline installs working. BASH_SOURCE is unset
+# when bash is invoked from stdin (curl | bash), and `set -u` would trip on a
+# bare reference — default to empty so the curl-pipe path falls through cleanly.
+here="$(cd "$(dirname "${BASH_SOURCE[0]:-}")" 2>/dev/null && pwd)" || here=""
 if [ -n "$here" ] && [ -f "$here/bin/install.js" ]; then
   exec node "$here/bin/install.js" "$@"
 fi
 
-# Curl-pipe path: delegate to npx. The `--` separates npx flags from our flags.
+# Curl-pipe path: delegate to npx. We do NOT pass `--` here — npm 7+ npx
+# already forwards trailing args to the package, and a literal `--` tripped
+# bin/install.js's parseArgs as an unknown flag.
 if ! command -v npx >/dev/null 2>&1; then
   echo "caveman: npx required (ships with Node ≥18). Reinstall Node.js." >&2
   exit 1
 fi
 
-exec npx -y "github:$REPO" -- "$@"
+exec npx -y "github:$REPO" "$@"

tests/installer/unit.argv.test.mjs

@@ -99,6 +99,13 @@ test('--config-dir expands ~ to home directory', async () => {
   }
 });
 
+test('bare -- (POSIX end-of-options) is accepted and ignored', () => {
+  // Regression: npx forwarded `--` from `curl|bash -- --only openclaw` to the
+  // package, and parseArgs rejected it as an unknown flag. Now we accept it.
+  const r = run('--', '--only', 'claude', '--non-interactive', '--dry-run', '--config-dir', '/tmp/__cm_dashdash');
+  assert.equal(r.status, 0);
+});
+
 test('--help discloses --config-dir scope', () => {
   const r = run('--help');
   assert.equal(r.status, 0);